On failure of pcibios_sriov_enable(), drivers/pci/iov.c calls
pcibios_sriov_disable() unconditionally. pseries frees
pdn->pe_num_map without NULLing it, both on the error path of
pseries_pci_sriov_enable() and in pseries_pcibios_sriov_disable(),
so the dangling pointer is freed again when the core cleans up.
Set pdn->pe_num_map to NULL after kfree() in both places.
Fixes: 9a7f6b438664 ("powerpc/pseries/pci: Associate PEs to VFs in configure
SR-IOV")
Cc: [email protected]
Reported-by: [email protected]
Link:
https://sashiko.dev/#/patchset/20260813035323.245229-1-yijiangshan%40kylinos.cn
Signed-off-by: Jiangshan Yi <[email protected]>
---
arch/powerpc/platforms/pseries/pci.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/arch/powerpc/platforms/pseries/pci.c
b/arch/powerpc/platforms/pseries/pci.c
index 6fc13f4a79a3..13d0baea5786 100644
--- a/arch/powerpc/platforms/pseries/pci.c
+++ b/arch/powerpc/platforms/pseries/pci.c
@@ -154,6 +154,7 @@ static int pseries_pci_sriov_enable(struct pci_dev *pdev,
u16 num_vfs)
if (rc) {
dev_err(&pdev->dev, "Failure to enable sriov: %x\n", rc);
kfree(pdn->pe_num_map);
+ pdn->pe_num_map = NULL;
} else {
pci_vf_drivers_autoprobe(pdev, false);
}
@@ -175,6 +176,7 @@ static int pseries_pcibios_sriov_disable(struct pci_dev
*pdev)
pdn = pci_get_pdn(pdev);
/* Releasing pe_num_map */
kfree(pdn->pe_num_map);
+ pdn->pe_num_map = NULL;
/* Release PCI data */
remove_sriov_vf_pdns(pdev);
pci_vf_drivers_autoprobe(pdev, true);
--
2.25.1
